oscrypto

oscrypto is a compilation-free encryption library for Python that delegates cryptographic operations to the operating system’s native crypto libraries: Microsoft’s CNG on Windows, Security.framework on macOS, and OpenSSL on Linux and BSD. Because it uses ctypes to call these system libraries, it installs with no C compiler and stays current with OS security updates.

It provides a broad set of primitives, including symmetric and asymmetric encryption, signing and verification, key derivation, X.509 handling, and TLS sockets, all with a consistent pure-Python API across CPython and PyPy.

What You Get

• Symmetric encryption (AES, 3DES, RC2/RC4) and asymmetric RSA/DSA/EC operations
• Signing and verification with PKCS#1 v1.5, PSS, and OAEP padding schemes
• Key derivation (PBKDF2, PBKDF1) and PKCS#8/PKCS#12 key and certificate loading
• A TLS client socket wrapper for secure connections without extra dependencies

Common Use Cases

• Adding encryption to a Python app without shipping a C compiler or wheels
• Loading and using RSA/EC keys and X.509 certificates from PKCS#8 or PKCS#12
• Opening TLS connections that rely on the operating system’s trust store

Under The Hood

Architecture - oscrypto is organized as backend packages that each bind to a native crypto provider through ctypes: _openssl for Linux/BSD, _osx for macOS Security.framework/Security Transforms, and _win for Windows CNG/CryptoAPI. A shared front layer (symmetric, asymmetric, kdf, tls, keys modules) presents one API and dispatches to the correct backend at import time based on the platform, converting between Python types and the OS library’s C structures.

Tech Stack - Almost entirely Python (99.8%) with no compiled extensions; it depends on asn1crypto for parsing/serializing ASN.1, X.509, and key structures, and on ctypes for the FFI. It supports an unusually wide Python range (2.6 through 3.14 plus PyPy).

Code Quality - The repo is actively maintained (16+ commits/month) with extensive CI across operating systems and Python versions, a large test suite, and long-standing single-maintainer stewardship. The backend-per-OS structure is disciplined, though the ctypes bindings are inherently low-level and platform-specific.

API Design - The public API is task-oriented and readable (oscrypto.asymmetric.rsa_pkcs1v15_sign, oscrypto.symmetric.aes_cbc_pkcs7_encrypt, oscrypto.tls.TLSSocket), hiding backend differences behind consistent function names. Some cryptography knowledge is required to choose the right primitive, so the learning curve reflects the domain more than the library.